The Grav API plugin fails to enforce proper authorization before allowing API key generation or revocation. Because the plugin intercepts tasks before the account‑management ACL authorizes the caller, any user who has the basic admin.login permission can create a persistent API key tied to any target account. The forged key inherits the permissions of the target account, which on installations where the account has wider privileges enables impersonation and full privilege escalation, effectively allowing an attacker to take over the account.

This flaw affects installations of Grav using the grav-plugin-api before version 1.0.8. The affected product is Grav by getgrav; any site running Grav prior to the 1.0.8 release is vulnerable.

The CVSS score of 8.7 indicates a high severity risk. The EPSS score is less than 1%, suggesting a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the attack relies solely on the admin.login permission, which every panel user possesses, an internal attacker or compromised user can easily spawn the attack. The attacker can then generate a key bound to a target user, granting full API access and full account control. Thus the exploit path is simple and requires no external access beyond normal administrative login privileges.